home

client.exe

Software Jockey

This is published and distributed via an Adknowledge's advertising supported (adware) software installer. The application client.exe by Software Jockey has been detected as adware by 15 anti-malware scanners. This executable runs as a local area network (LAN) Internet proxy server listening on port 49372 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host.
Publisher:
Software Jockey  (signed and verified)

MD5:
644e552a81ade2c942e57f10be8a4e0a

SHA-1:
cb1cef6e754f707af98aaa7e4824d34a47404bf0

SHA-256:
0a0f4d8d7458f48585d14f6a598895817458706ba284c454debc696ba7ed8799

Scanner detections:
15 / 68

Status:
Adware

Explanation:
This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Analysis date:
12/23/2024 11:34:06 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Graftor.164387
745

AVG
Generic
2016.0.3223

Bitdefender
Gen:Variant.Adware.Graftor.164387
1.0.20.105

Emsisoft Anti-Malware
Gen:Variant.Adware.Graftor.164387
8.15.01.21.02

ESET NOD32
MSIL/Adware.iBryte (variant)
9.10787

F-Secure
Gen:Variant.Adware.Graftor.164387
11.2015-21-01_4

G Data
Gen:Variant.Adware.Graftor.164387
15.1.24

K7 AntiVirus
Adware
13.186.14150

Kaspersky
not-a-virus:AdWare.MSIL.RocketTab
14.0.0.2610

MicroWorld eScan
Gen:Variant.Adware.Graftor.164387
16.0.0.63

Panda Antivirus
Trj/Genetic.gen
15.01.21.02

Reason Heuristics
PUP.Adknowledge.SoftwareJockey
15.1.21.2

VIPRE Antivirus
AdKnowledge
35160

File size:
5.6 MB (5,828,840 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\search extensions\client.exe

Digital Signature
Signed by:
Software Jockey

Authority:
COMODO CA Limited

Valid from:
3/23/2014 8:00:00 PM

Valid to:
3/24/2015 7:59:59 PM

Subject:
CN=Software Jockey, O=Software Jockey, STREET="4600 Madison Ave, 10th FL", L=Kansas City, S=Missouri, PostalCode=64112, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
3481FC293A085AD3BA94D30DC9CC2E95

File PE Metadata
Compilation timestamp:
11/26/2014 9:00:28 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:aa20+++tsyu3Yq7oPTLoPX7ir4jVrwd4NANPOPlGYsdAW/WLALW7zjBRMMcO1LUl:acjBFL9npnaHOmqm1bs71++or

Entry address:
0x1E9F

Entry point:
E8, 3B, 27, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 7D, 08, 00, 74, 2D, FF, 75, 08, 6A, 00, FF, 35, 4C, BB, 98, 00, FF, 15, 3C, 80, 40, 00, 85, C0, 75, 18, 56, E8, ED, 27, 00, 00, 8B, F0, FF, 15, 38, 80, 40, 00, 50, E8, 9D, 27, 00, 00, 59, 89, 06, 5E, 5D, C3, 6A, 0C, 68, B0, A4, 40, 00, E8, 01, 25, 00, 00, 6A, 0E, E8, ED, 2A, 00, 00, 59, 83, 65, FC, 00, 8B, 75, 08, 8B, 4E, 04, 85, C9, 74, 2F, A1, A0, AF, 98, 00, BA, 9C, AF, 98, 00, 89, 45, E4, 85, C0, 74, 11, 39, 08, 75, 2C, 8B, 48, 04, 89, 4A...
 
[+]

Entropy:
4.3432

Code size:
25.5 KB (26,112 bytes)

Local Proxy Server
Proxy for:
Internet Settings

Local host address:
http://127.0.0.1:49372/

Local host port:
49372

Default credentials:
No


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to static-acs-24-101-16-40.zoominternet.net  (24.101.16.40:80)

TCP (HTTP):
Connects to s3-1-w.amazonaws.com  (54.231.13.201:80)

TCP (HTTP):
Connects to ord08s11-in-f5.1e100.net  (173.194.46.69:80)

TCP (HTTP):
Connects to ord08s11-in-f4.1e100.net  (173.194.46.68:80)

TCP (HTTP SSL):
Connects to ord08s11-in-f23.1e100.net  (173.194.46.87:443)

TCP (HTTP):
Connects to ord08s11-in-f19.1e100.net  (173.194.46.83:80)

TCP (HTTP SSL):
Connects to ord08s11-in-f16.1e100.net  (173.194.46.80:443)

TCP (HTTP SSL):
Connects to ord08s11-in-f15.1e100.net  (173.194.46.79:443)

TCP (HTTP):
Connects to ord08s11-in-f14.1e100.net  (173.194.46.78:80)

TCP (HTTP):
Connects to ec2-23-21-54-14.compute-1.amazonaws.com  (23.21.54.14:80)

TCP (HTTP SSL):
Connects to cloud.gti.mcafee.com  (161.69.92.6:443)

TCP (HTTP):
Connects to 184.172.26.52-static.reverse.softlayer.com  (184.172.26.52:80)

Remove client.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.